Executive Summary

This vulnerability exists in the Linux kernel's SCTP (Stream Control Transmission Protocol) implementation, specifically in the handling of embedded INIT chunks and address list lengths within a cookie.

The function sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but it did not ensure that the INIT chunk was large enough to contain a complete INIT header. This allows a malformed COOKIE_ECHO message to carry a truncated INIT chunk with a length smaller than the expected size.

As a result, later processing in sctp_process_init() accesses INIT parameters without proper validation, which can lead to out-of-bounds reads.

Additionally, the raw_addr_list_len field is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len, causing sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads.

The fix involves requiring the embedded INIT chunk length to be at least the size of a complete INIT chunk, validating that the INIT chunk and raw address list together fit within the cookie payload, and verifying sufficient data exists for each address parameter before parsing.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to out-of-bounds memory reads in the Linux kernel's SCTP implementation.

An attacker could exploit this by sending malformed COOKIE_ECHO messages with truncated or oversized embedded INIT chunks or address lists, potentially causing the kernel to read memory beyond intended boundaries.

Such out-of-bounds reads may lead to information disclosure, kernel instability, or crashes, depending on how the memory is accessed and handled.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is fixed by validating the embedded INIT chunk length and the raw address list length within the SCTP cookie payload to prevent out-of-bounds reads.

• Ensure that the embedded INIT chunk length is at least the size of struct sctp_init_chunk.
• Validate that the INIT chunk and raw address list together fit within the cookie payload.
• Verify sufficient data exists for each address parameter header and payload before parsing.

Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled; this will be addressed in a separate patch.

Useful 0 Not Useful 0